Define protected route map
FoxPlot now has a centralized map of public, account, author, advertiser, admin, and super-admin route expectations.
Keep this route map aligned with every new page added to the app.
FoxPlot Admin
Route Protection
Prepare Clerk role enforcement, protected route rules, server-side authorization, API route protection, and production access-denied audit logging.
Routes
33
Public
10
Protected
23
Admin
23
Route guard rollout note
Keep production enforcement in demo-open mode until Clerk role metadata, database account records, and admin user verification are confirmed. Once roles are reliable, switch enforcement to role-enforced mode and protect every sensitive API route server-side.
Route Guard Evaluator
Test access before enforcement
Preview how FoxPlot should handle route access once Clerk roles and server-side authorization are connected.
Protection mode
Authentication state
Role
Access result
Allowed
Demo mode keeps routes open for development, but production should enforce the listed roles and permissions.
Production preview: this role would be blocked once role enforcement is enabled.
Required roles
AdminSuper Admin
Missing permissions
View revenue
Production Checklist
Backend route protection rollout
Store user roles in database
Production accounts need trusted roles stored in the AppUser database table via Hexclave user ID.
Role is set on AppUser.role (CONSUMER, AUTHOR, ADMIN). Upgrades happen through an explicit grant flow.
Add proxy or middleware enforcement
Protected pages should be blocked before rendering when the user is not authenticated or lacks the required role.
Next.js 16 prefers proxy.ts over middleware.ts. Keep enforcement disabled until Clerk roles are confirmed.
Protect API routes server-side
API routes for books, media, payouts, ads, reports, privacy requests, support, and admin actions must verify role access.
Never rely only on frontend buttons or hidden links. Every sensitive API route needs its own server-side authorization check.
Write access-denied audit logs
Blocked admin access attempts, suspicious account activity, payout changes, privacy requests, and role changes should create permanent security records.
Connect denied access events to the Security Events system and database audit tables.
Final production hardening
Before public launch, verify private routes, server checks, upload permissions, media access, source map settings, and sensitive metadata exposure.
Perform this pass after backend auth, database records, payments, media storage, and moderation workflows are connected.
Route Access Map
Current protected route rules
| Route | Risk | Access | Roles | Permissions |
|---|---|---|---|---|
Homepage / | Public | Public | No role required | No permission required |
Public Library /library | Public | Public | No role required | View public library |
Privacy Policy /privacy | Public | Public | No role required | No permission required |
Terms and Conditions /terms | Public | Public | No role required | No permission required |
Content Policy /content-policy | Public | Public | No role required | No permission required |
Advertising Policy /advertising-policy | Public | Public | No role required | No permission required |
Become an Author /become-author | Public | Public | No role required | No permission required |
Become an Advertiser /become-advertiser | Public | Public | No role required | No permission required |
Sign Up /sign-up | Public | Public | No role required | No permission required |
Report a Concern /report | Public | Public | No role required | No permission required |
Account Dashboard /account | Account | Protected | ReaderAuthorAdvertiserAdminSuper Admin | Manage account safety |
Account Safety Settings /account/safety | Account | Protected | ReaderAuthorAdvertiserAdminSuper Admin | Manage account safety |
Account Privacy Requests /account/privacy | Account | Protected | ReaderAuthorAdvertiserAdminSuper Admin | Manage account safety |
Author Dashboard /author | Portal | Protected | AuthorAdminSuper Admin | Submit author content |
New Author Submission /author/submissions/new | Portal | Protected | AuthorAdminSuper Admin | Submit author content |
Author Ads to Claim /author/ads | Portal | Protected | AuthorAdminSuper Admin | Claim author ads |
Author Appeals /author/appeals | Portal | Protected | AuthorAdminSuper Admin | Submit author content |
Author Payout Requests /author/payouts | Portal | Protected | AuthorAdminSuper Admin | Request author payouts |
Advertiser Dashboard /advertiser | Portal | Protected | AdvertiserAdminSuper Admin | Submit ads |
New Ad Submission /advertiser/ads/new | Portal | Protected | AdvertiserAdminSuper Admin | Submit ads |
Advertiser Campaigns /advertiser/campaigns | Portal | Protected | AdvertiserAdminSuper Admin | Manage ad campaigns |
Admin Dashboard /admin | Admin | Protected | AdminSuper Admin | View admin dashboard |
Content Review Queue /admin/content-review | Admin | Protected | AdminSuper Admin | Review content |
Reports and Enforcement /admin/reports | Admin | Protected | AdminSuper Admin | Review content |
Privacy Requests /admin/privacy-requests | Admin | Protected | AdminSuper Admin | Manage access control |
Safety Center /admin/safety | Admin | Protected | AdminSuper Admin | Manage platform safety |
Access Control /admin/access | Admin | Protected | AdminSuper Admin | Manage access control |
Launch Readiness /admin/launch-readiness | Admin | Protected | AdminSuper Admin | Manage access control |
Backend Readiness /admin/backend-readiness | Admin | Protected | AdminSuper Admin | Manage access control |
Author Management /admin/authors | Admin | Protected | AdminSuper Admin | Manage authors |
Ad Campaign Review /admin/ads | Admin | Protected | AdminSuper Admin | Manage ads |
Payout Review Queue /admin/payouts | Admin | Protected | AdminSuper Admin | Review payouts |
Revenue Analytics /admin/revenue | Admin | Protected | AdminSuper Admin | View revenue |